About OtakarKlier

Hello, Are you performing ssl decryption? If yes try disabling it and see if the results are different.   Regards, ... View more

Hello, Ok you have multiple options. The easiest might be to use the Day1 configuration tool. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PM2lCAG If you are migrating from another platform to a Palo Alto, you can try to use Expedition or IronSkillet. https://live.paloaltonetworks.com/t5/expedition-articles/expedition-ironskillet-and-best-practices/ta-p/255373 I also have a day 1 configuration that you can use that is more detailed than the Day1 or IronSkillet, but requires more familiarity with the PAN. See Attached. I do have a brief guide, but you'll want to go through the free training prior to get familiarity with the PaloAlto. https://beacon.paloaltonetworks.com/student/catalog/list?category_ids=19944-digital-learning   Doesnt look like I can attach my config, but if you message me your email, I can email it to you. Regards, ... View more

Hello, You can add the source IP of the scanner as an Address Exclusion in the zone protection profile. The other thing I have done in the past is slow the scanner down, i.e. only uses 1 check at a time.   Regards, ... View more

Hello, Onto the firewall. It will use some of the files in that installer package when installing the 9.1.9 package.   Regards, ... View more

Hello, What do your unified logs show for the traffic? What about the Service Route Configuration? Some models of PAN you cannot use the management interface as the source of the Netflow traffic.   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UuYCAU   Regards, ... View more

Honestly I am not sure if 9.0 has it. You're better off running a newer version if your PAN supports it. ... View more

Hello, The way I prefer to create this is to use a trunk from the switch to the firewall (layer2) and then use a vlan interface as the layer3 gateway. The trunk allows for future flexibility (e.g. allowing additional vlans over the same wire). You will also need to add a static route in the virtual router so the PAN knows where to send the traffic, i.e. destination 10.10.20.0/24 interface vlan (MGMT), next hop = none.   Hope that helps.   ... View more

Hello, Do you need that many objects? Maybe a way to truncate the list by using subnets or something else?   Just thinking out loud. ... View more

Yep my bad on that passphrase part. ... View more

However only 1 profile per interface. ... View more

Hello, While I havent done it, it should be possible, yes.   Regards, ... View more

Hello, Yes it is possible. Setup your dynamic DNS interfaces first and test with an external service to make sure its resolving correctly: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/configure-dynamic-dns-for-firewall-interfaces https://toolbox.googleapps.com/apps/dig/ Then setup your VPN tunnel. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGkCAK https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clh5CAC   Cheers!     Regards, ... View more

Hello, Looks similar to your other post. https://live.paloaltonetworks.com/t5/general-topics/vpn-two-interconnected-sites-public-ip-dhcp-dyndns/td-p/417986 Do you have additional questions that have not been answered? Regards, ... View more